From: Rod Taylor <pg@rbt.ca>
To: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Eugene E. <sad@bankir.ru>
Cc: pgsql-sql@postgresql.org
Subject: Re: Permission to Select
Date: Mon, 13 Mar 2006 10:10:51 -0500
Message-ID: <1142262651.857.77.camel@home> (raw)
In-Reply-To: <20060313144617.GG8274@surnet.cl>
References: <Pine.LNX.4.44.0507280919020.4325-100000@matrix.gatewaynet.com>
<441540AA.3090202@bankir.ru>
<1142260392.857.49.camel@home>
<20060313144617.GG8274@surnet.cl>
On Mon, 2006-03-13 at 10:46 -0400, Alvaro Herrera wrote:
> Rod Taylor wrote:
>
> > By allowing the user a where clause you grant them select privileges.
> > You will find that delete works the same way.
> >
> > This is one of those times when per column permissions are useful. You
> > could grant them select access on the "name" column but not the "salary"
> > column.
>
> If I understand clearly, the patch he posted modified things so that if
> the user issued an UPDATE command, the SELECT permission was required as
> well. Thus a user with UPDATE privileges but no SELECT was not allowed
> to execute the UPDATE command.
Okay, I got it backward. The exclamation mark behind the first point
made me think it was an issue.
What information can be retrieved from a structure by being able to
update all rows? You possibly find the range of values (max/min via
integer overflow) but still would not know which tuple is associated
with which value.
I don't have a use-case for update but the delete / insert combination
is quite handy for doing data resets from a host which should not be
able to retrieve the interim states.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: pg@rbt.ca, alvherre@commandprompt.com, sad@bankir.ru
Subject: Re: Permission to Select
In-Reply-To: <1142262651.857.77.camel@home>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox